cloudwatch_logs

CloudWatch Logs API

Use the AWS CloudWatch Logs API to query log groups, search log events, and run CloudWatch Logs Insights queries.

Setup Guide

This skill requires read-only access to AWS CloudWatch Logs. No write or delete permissions are needed — Byaan only reads your logs, it never modifies them.

Choose an authentication mode

• Instance IAM role (recommended when Byaan runs on AWS) — no keys to create, store, or rotate. Byaan uses the AWS default credential chain (EC2 instance profile / ECS task role / env credentials). Select "Instance IAM role (auto)" and set only the Region.
• Access keys — for Byaan deployments outside AWS. An IAM user with programmatic access (Access Key ID + Secret Access Key) and read-only CloudWatch Logs permissions. Create a dedicated IAM user for Byaan rather than reusing an admin account.

Option A: Instance IAM role

1. In the AWS Console → IAM → Roles, create (or reuse) a role for the EC2 instance / ECS task running Byaan
2. Attach the CloudWatchLogsReadOnlyAccess managed policy, or the custom read-only policy shown below
3. Attach the role to the instance (EC2 → Instance → Actions → Security → Modify IAM role) or the ECS task definition
4. If Byaan runs in Docker on EC2 (the standard self-hosted setup), the container must be able to reach instance metadata. IMDSv2's default hop limit of 1 blocks containers — raise it once:

aws ec2 modify-instance-metadata-options --instance-id i-xxxx --http-put-response-hop-limit 2 --http-tokens required

1. In Byaan, go to Settings > Skills > CloudWatch Logs, choose Instance IAM role (auto), and set the Region

Option B: Access keys — step-by-step

1. In the AWS Console → IAM → Users, create a new user (e.g., byaan-cloudwatch-reader)
2. Attach the AWS managed policy CloudWatchLogsReadOnlyAccess, or create a custom policy with these specific actions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:FilterLogEvents",
        "logs:GetLogEvents",
        "logs:GetLogRecord",
        "logs:StartQuery",
        "logs:GetQueryResults",
        "logs:StopQuery"
      ],
      "Resource": "*"
    }
  ]
}